# Erreur accès WebService REST

**URL:** <https://www.ruby-forum.com/t/erreur-acca-s-webservice-rest/196576>\
**Category:** Deployment\
**Created:** [January 16, 2008, 11:09pm UTC](https://www.ruby-forum.com/t/erreur-acca-s-webservice-rest/196576 "2008-01-16T23:09:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [January 16, 2008, 11:09pm UTC](https://www.ruby-forum.com/t/erreur-acca-s-webservice-rest/196576/1 "2008-01-16T23:09:02Z")

</div>

I am trying to write a REST web service

testing locally is fine but whane I deploy the server and try test it  
via curl

curl -i -X POST -H ‘Content-Type:application/xml’ -d ‘’  
[http://mytesteddomain.tld/user/posts/createReference.xml](http://mytesteddomain.tld/user/posts/createReference.xml)

I get an error :

ERROR TYPE: ActionController::InvalidAuthenticityToken

ERROR MESSAGE: ActionController::InvalidAuthenticityToken

I don’t have any protection in my app as I put a filter to avoid the  
login check  
before\_filter :login\_required, :except =\> [:createReference]

my Apache vhost.conf doesn’t block :

\<Directory “/var/rails/mytesteddomainname/current/public”\>  
Options FollowSymLinks  
AllowOverride None  
Order allow,deny  
Allow from all

where should I start looking for ?

thansk for your help

---

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [January 17, 2008, 1:25am UTC](https://www.ruby-forum.com/t/erreur-acca-s-webservice-rest/196576/2 "2008-01-17T01:25:30Z")

</div>

> curl -i -X POST -H ‘Content-Type:application/xml’ -d ‘’  
> [http://mytesteddomain.tld/user/posts/createReference.xml](http://mytesteddomain.tld/user/posts/createReference.xml)

Shouldn’t that URL have a user number in it e.g. …/user/1/posts/…

without that it is probably redirecting to a secured page and hence the  
error.

---

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [January 17, 2008, 10:19am UTC](https://www.ruby-forum.com/t/erreur-acca-s-webservice-rest/196576/3 "2008-01-17T10:19:54Z")

</div>

Kad K. escribió:

> ERROR TYPE: ActionController::InvalidAuthenticityToken
> 
> ERROR MESSAGE: ActionController::InvalidAuthenticityToken

Maybe, you have in your controller (or application controller):

```
protect_from_forgery

```

That protect you from xss.  
Error said: You aren’t sending “InvalidAuthenticityToken” then you have  
two options:

```
- Bypass this check in this action. In you controller put:
      protect_from_forgery :except => 

```

[:autocomplete\_google\_map\_city]

```
- Send the parameter "InvalidAuthenticityToken". Create a hidden

```

tag(helper) with it:

def token\_tag  
unless protect\_against\_forgery?  
‘’  
else  
tag(:input, :type =\> “hidden”, :name =\>  
request\_forgery\_protection\_token.to\_s, :value =\>  
form\_authenticity\_token)  
end  
end

Regards!

–  
Rafael Garcia Ortega